CN110178114B

CN110178114B - Vehicle control device and program update system

Info

Publication number: CN110178114B
Application number: CN201880005461.4A
Authority: CN
Inventors: 中原章晴; 黑泽宪一; 荒木肇; 寺冈秀敏
Original assignee: Hitachi Astemo Ltd
Current assignee: Hitachi Astemo Ltd
Priority date: 2017-01-25
Filing date: 2018-01-17
Publication date: 2023-05-12
Anticipated expiration: 2038-01-17
Also published as: EP3575954B1; WO2018139296A1; JP6682019B2; JPWO2018139296A1; US10871959B2; US20190265967A1; EP3575954A1; EP3575954A4; CN110178114A

Abstract

The invention provides a vehicle control device and a program update system capable of effectively suppressing erroneous execution and update of a plurality of control programs stored in a nonvolatile memory. A vehicle control device (11) of the present invention has a FlashROM (112) and an arithmetic unit (111). And, the FlashROM (112) has: a 1 st area (1124) and a 2 nd area (1125) in which control programs executable by the arithmetic unit (111) are stored; and a plurality of management data areas (1123 a, 1123b, 1123 c) for storing management data including current program area information indicating one of the 1 st area (1124) and the 2 nd area (1125) which is a storage area storing a current control program to be executed in the operation unit (111).

Description

Vehicle control device and program update system

Technical Field

The present invention relates to a vehicle control device and a program update system.

Background

The vehicle control device includes a computing unit (for example, a microcomputer) for executing a control program for controlling the operation of the vehicle, and a rewritable nonvolatile memory such as FlashROM (Read Only Memory) for storing the control program executed by the computing unit.

Conventionally, a control program of a vehicle control device is often updated by a professional maintainer connecting a program writing device to a vehicle that is brought to a sales shop, a repair shop, or the like. However, due to the rapid spread of so-called "networked vehicles" in which vehicles are always connected to the internet by wireless communication, it is also assumed that control programs for vehicles are updated by users themselves via wireless communication, as well as function addition in car navigation systems and updating of map data and the like.

On the other hand, when the new version of the control program fails to be written due to a factor (such as communication interruption or occurrence of hardware abnormality) during the update of the control program of the vehicle control device, the new version of the control program is not usable, and even the old version of the control program is not usable or becomes defective, and in the worst case, there is a possibility that the vehicle is not started.

For this reason, for example, in the control unit for an automobile disclosed in patent document 1 below, a main storage area for storing a current control program and a sub-storage area for storing a new version of the control program for updating are provided in FlashROM, and writing is alternately performed in each area when the control program is updated, whereby even if writing of the new version of the control program fails, the old version of the control program can be used continuously.

When the updated control program is executed, the vehicle control unit accesses each storage area storing programs of different versions, reads out version information given to each control program, compares the version information, and executes one of the new versions identified as the current control program.

Prior art literature

Patent literature

Patent document 1: japanese patent laid-open No. 2006-301960

Disclosure of Invention

Problems to be solved by the invention

In a configuration in which a newer version among 2 control programs having different versions stored in storage areas is executed as an existing control program, such as the above-described vehicle control unit, it is necessary to determine which storage area stores the existing control program. The same is true when the control program is updated. Therefore, information for determining which storage area stores the current control program is important.

Accordingly, an object of the present invention is to appropriately execute and update a plurality of control programs stored in a nonvolatile memory.

Technical means for solving the problems

A vehicle control device according to an embodiment of the present invention includes a rewritable nonvolatile memory and an arithmetic unit, the nonvolatile memory including: a 1 st memory area and a 2 nd memory area for storing a control program executable by the arithmetic unit; and a plurality of management data storage areas for storing management data including current program area information indicating which of the 1 st storage area and the 2 nd storage area is the storage area storing the current control program being executed by the arithmetic unit.

Drawings

Fig. 1 is a configuration diagram of a program update system including a vehicle control device according to an embodiment of the present invention.

Fig. 2 is a configuration diagram of an in-vehicle network system included in the vehicle.

Fig. 3 is a functional block diagram of the vehicle control apparatus.

Fig. 4 is a diagram showing an example of arrangement of management data areas.

Fig. 5 is a diagram showing another configuration example of the management data area.

Fig. 6 is a sequence diagram showing an example of a process of downloading an update package to a vehicle.

Fig. 7 is a diagram showing an example of the structure of an update package.

Fig. 8 is a sequence chart showing an example of the process of updating the control program of the vehicle control apparatus.

Fig. 9 is a flowchart showing an example of processing executed by the vehicle control apparatus to acquire the current program area information.

Fig. 10 is a flowchart showing an example of the majority decision processing.

Fig. 11 is a flowchart showing an example of the validity determination process.

Fig. 12 is a configuration example of a response message for transmitting the current program area information to the gateway by the vehicle control apparatus.

Fig. 13 is a flowchart showing an example of processing executed by the gateway to determine whether to start reprogramming.

Fig. 14 is a flowchart showing an example of processing executed by the gateway to perform a program area switching request to the vehicle control apparatus.

Fig. 15 is a command example of a program area switch request.

Fig. 16 is a flowchart showing an example of the process of switching the program area by the vehicle control apparatus.

Fig. 17 is a flowchart showing an example of a process of starting a control program executed in the vehicle control apparatus.

Fig. 18 is a diagram showing an example of the structure of management data having a plurality of pieces of information including current program area information.

Detailed Description

Next, a program update system according to an embodiment of the present invention will be described with reference to the drawings.

Fig. 1 is a configuration diagram of a program update system according to an embodiment of the present invention. The program update system includes a vehicle 1, a server 2, an internet line 3, and a wireless base station 4. The vehicles 1 are connected to the server 2 via the internet line 3 and the wireless base station 4 by wireless communication to communicate with each other. The wireless communication is realized by using a mobile phone network based on a public line such as 3G/LTE, a line such as WiFi, or the like, for example. The server 2 distributes to the vehicle 1 an update package 5 necessary for updating the control program of the vehicle control device 11 included in the vehicle 1. The vehicle control device 11 of the vehicle 1 uses the update package 5 to update the control program.

Fig. 2 is a configuration diagram of an in-vehicle network system mounted on the vehicle 1. The vehicle control device 11 is a device that executes a control program for controlling the operation of the vehicle 1, and is connected to the gateway 12 via the in-vehicle network 13 (for example, CAN (Car Area Network)). The vehicle control device 11 may communicate with other vehicle control devices 11 via the gateway 12.

The gateway 12 also functions as a program writing device for controlling updating of a control program of the vehicle control device 11. The gateway 12 receives the update package 5 from the server 2, and transmits an update command (reprogramming command) of the control program and the control program for update to the vehicle control device 11. A program writing device may be provided separately from the gateway 12.

The gateway 12 includes computation units 121, flashROM (Read Only Memory), 122, SRAM (Static Random Access Memory), 123 and a communication device 124 including a CAN transceiver and a wireless communication module. The arithmetic unit 121 executes a program stored in the FlashROM 122, thereby performing communication with the vehicle control device 11 or the server 2 on the in-vehicle network 13. In addition, at the time of updating the control program of the vehicle control device 11, the gateway 12 receives the update package 5 from the server 2 and temporarily stores it in the FlashROM 122, and updates the control program of the vehicle control device 11 using the temporarily stored update package 5.

The HMI (Human-Machine Interface Human-machine interface) 14 is constituted by, for example, a liquid crystal display device for various displays attached to the center of the dashboard of the vehicle 1, operation switches disposed in the vicinity thereof, and an in-vehicle speaker. The HMI 14 makes various displays to the occupant of the vehicle 1 or processes various input operations. The HMI 14 also performs display and operation input related to updating of the control program of the vehicle control device 11.

Fig. 3 is a functional block diagram of the vehicle control device 11. The vehicle control device 11 includes an arithmetic unit 111, a flash rom 112, an SRAM 113, and a communication device 114 (for example, a CAN transceiver).

The arithmetic unit 111 is an arithmetic device such as a microcomputer that executes a control program stored in the FlashROM 112. Hereinafter, for convenience of description, each program will be described as an operation subject, but the calculation unit 111 actually executes the program.

The FlashROM 112 is a rewritable nonvolatile memory, and stores a startup program 1121, a rewrite program 1122, a majority decision program 1126, and a validity decision program 1127. Further, the FlashROM 112 has a 1 st area 1124 as a 1 st storage area, a 2 nd area 1125 as a 2 nd storage area, and a plurality of

management data areas

1123a, 1123b, 1123c as a plurality of management data storage areas.

The 1 st area 1124 is a storage area in which control programs executable by the arithmetic unit 111 are stored. The 2 nd area 1125 is a storage area in which the storage operation unit 111 can execute a control program having a version different from that of the control program stored in the 1 st area 1124. The plurality of

management data areas

1123a, 1123b, 1123c are memory areas for storing management data including current program area information indicating one of the 1 st area 1124 and the 2 nd area 1125 which is a memory area for storing a current control program to be executed by the operation unit 111.

The start-up program 1121 is a program that the arithmetic unit 111 first executes when the vehicle control device 11 starts up in the normal mode.

The rewriting program 1122 is a program executed by the operation unit 111 when the vehicle control device 11 shifts to a reprogramming mode (hereinafter referred to as "reprogramming mode"). When the arithmetic unit 111 executes the rewriting program 1122, the existing control program stored in one of the 1 st area 1124 and the 2 nd area 1125 is left as it is in accordance with a request from the gateway 12, and the control program of the old version or the empty data of the non-existing control program stored in the other area is rewritten to a new version for updating (hereinafter simply referred to as "new control program"). In the present embodiment, as an example, in the pre-update state, the current control program P1 is stored in the 1 st area 1124, and the old version control program or dummy data is stored in the 2 nd area 1125.

The majority decision process 1126 and the validity decision process 1127 will be described later.

Fig. 4 is a diagram showing an example of arrangement of the

management data areas

1123a, 1123b, 1123c. The

management data areas

1123a, 1123b, 1123c are collectively arranged in 1 physical block which is a unit block for erasing and writing of the flash rom 112. The

management data areas

1123a, 1123b, 1123c are configured to store

management data

1, 2, 3 of the same content. In the present embodiment, the

management data areas

1123a, 1123b, 1123c

store management data

1, 2, 3 of the same content. The

management data

1, 2, 3 respectively contain current program area information.

The current program area information is a flag indicating which of the 1 st area 1124 and the 2 nd area 1125 stores the current control program.

Fig. 5 is a diagram showing another configuration example of the

management data areas

1123a, 1123b, 1123c. The

management data areas

1123a, 1123b, 1123c are arranged in different physical blocks of the FlashROM 112 one by one in a scattered manner. By doing so, the possibility of losing all management data due to a write error or the like in a specific physical block can be reduced.

Fig. 6 is a sequence diagram showing an example of the process of downloading the update package 5 from the server 2 to the gateway 12.

When the control program of the vehicle control device 11 is corrected, the update package 5 for the server 2 is registered as a preparation for updating the control program. Then, at the time of starting ignition of the vehicle 1, the gateway 12 transmits a part number request message M601 requesting part numbers of the present control program to the vehicle control device 11. When the vehicle control device 11 receives the part number request message M601, the vehicle control device 11 transmits a response message M602 containing the part number of the existing control program and the existing program area information. The part number is a number (identification number) identifying the control program, and is uniquely added to each control program of each version, and the current control program, the new control program for updating, and the old control program have different part numbers from each other.

Next, the gateway 12 transmits an update package acquisition request message M603 to the server 2. The update package acquisition request message M603 includes the part number and the current program area information of the current control program of the vehicle control device 11 acquired from the response message M602. When the server 2 receives the update package acquisition request message M603, the server 2 selects a matching update package 5 from the registered update packages based on the part number and the current program area information contained therein, and transmits an update package distribution message M604 containing the update package 5 to the target vehicle 1 that transmitted the update package acquisition request message M603 (update package selection/distribution processing S601).

By transmitting the component number of the current control program and the current program area information to the server 2, an appropriate update package 5 can be selected in the server 2. If there is no matching update package 5, the server 2 transmits a message indicating this to the gateway 12, and the gateway 12 and the vehicle control apparatus 11 start up as usual without performing update processing.

The gateway 12 stores the distributed update package 5 in the FlashROM 122, and when all data of the update package 5 is stored, transmits a reception completion message M605 to the server 2 (update package storage processing S602). Thereafter, the gateway 12 performs updating of the control program of the vehicle control device 11 based on the received update package 5.

Fig. 7 shows an exemplary configuration of the update package 5 acquired from the server 2 by the gateway 12.

The update package 5 is composed of update control information 51 and update data 52.

The update control information 51 includes information such as a component number 511 of the current control program, a component number 512 of the new control program, storage area information 513 of the current control program, storage target area information 514 of the new control program, and write block information 515 of a plurality of flash roms.

The storage area information 513 of the current control program is information indicating which area of the 1 st area 1124 and the 2 nd area 1125 the current control program of the vehicle control device 11 is stored in. The storage target area information 514 of the new control program is information indicating a target area to which the new control program is to be written in the present update. In the present embodiment, in the pre-update state, "1 st area 1124" is stored in the storage area information 513 of the current control program, and "2 nd area 1125" is stored in the storage target area information 514 of the new control program. The write block information 515 of FlashROM is information indicating the head address, capacity (number of bytes) of each physical block of FlashROM. By including the part number 511 of the current control program and the storage area information 513 of the current control program in the update package 5, the gateway 12 can check the consistency of the requested data with the received data against these information. The update package 5 includes the part number 512 of the new control program and the storage target area information 514 of the new control program, and thus can be used for the above-described consistency check at the next update.

The update data 52 includes update data 521 as a new control program for updating. The update data 52 is not limited to the new control program itself, and may be, for example, data obtained by compressing the new control program or differential data between the current control program and the new control program.

Fig. 8 is a sequence chart showing an example of the process of updating the control program by the vehicle control device 11. Next, the update procedure in the present embodiment will be described with reference to fig. 8.

When the gateway 12 starts updating (starting reprogramming) of the control program, first, a current program information request message M801 is sent to the vehicle control apparatus 11 to request information related to the current control program. When the vehicle control device 11 receives the current program information request message M801, the vehicle control device 11 acquires information related to the current control program, and includes the result in the information response message M802 to transmit to the gateway 12 (current program information acquisition process S801). The information acquired here in relation to the current control program is the part number of the current control program and the current program area information. The current program area information is stored in the plurality of

management data areas

1123a, 1123b, 1123c, and the current program information acquisition process S801 for acquiring this information will be described later.

The gateway 12 compares the part number and the current program area information of the current control program included in the received information response message M802 with the part number and the current program area information of the current control program included in the gateway 12 itself, and determines that the update of the control program is started (reprogramming start determination processing S802). The reprogramming-start determining process S802 will be described later. If the comparison result matches, the gateway 12 transmits a mode transition request message mod to the vehicle control device 11, and causes the vehicle control device 11 to transition from the normal mode to the reprogramming mode. When the mode is changed to the reprogramming mode, the arithmetic unit 111 of the vehicle control apparatus 11 executes the rewriting program 1122. Thereby, the vehicle control device 11 and the gateway 12 start the program update process. If the comparison results are inconsistent, the program update process is not started.

In the program update process, the gateway 12 transmits an update program write message M803 to the vehicle control apparatus 11 to write a new control program for update in the write target area. The update program write message M803 includes update data 521 of the update package 5 (new control program for update) and storage target area information 514 of the new control program. When the vehicle control device 11 in the reprogramming mode receives the update program write message M803 from the gateway 12, update data 521 is written in the area indicated by the storage target area information 514 of the new control program in the 1 st area 1124 and the 2 nd area 1125 (write process S803). At this time of writing, the vehicle control device 11 may write the update data 521 after confirming that the area indicated by the current program area information acquired from the

management data areas

1123a, 1123b, 1123c is different from the area indicated by the storage target area information 514 of the new control program (i.e., writing of the new control program is performed to an area different from the area where the current control program is stored). When the writing of the update data 521 is completed, the vehicle control device 11 transmits a write completion response message M804 to the gateway 12.

The gateway 12 transmits a data validity check message M805 to the vehicle control device 11 to check the validity of the written data. When the vehicle control device 11 receives the data validity check message M805, the vehicle control device 11 checks the validity of the written new control program for updating (data validity check processing S804). In the validity check of the data, it is verified whether or not the data of the new control program to be written is erroneous (whether or not the updated data is correctly written). Specifically, the check is performed by an error detection means using a checksum, CRC (Cyclic Redundancy Check cyclic redundancy check), and hash value. When the validity of the data is confirmed, the vehicle control device 11 transmits a data validity response message M806 to the gateway 12.

When the validity of the data is confirmed, the gateway 12 determines whether or not the switching from one of the 1 st area 1124 and the 2 nd area 1125 to the other area is possible as the area in which the current control program is stored (current program area switching determination processing S805). The current program area switch determination process S805 will be described later. If it is determined that the switching is possible, the current program area switching request message M807 is transmitted to the vehicle control device 11. When the vehicle control device 11 receives the current program area switching request message M807, the vehicle control device 11 performs switching of the area in which the current control program is stored (current program area switching process S806). The current process domain switching processing S806 will be described later.

When the gateway 12 receives the zone switch completion response message M808 from the vehicle control device 11, it transmits a mode transition request message mod to the vehicle control device 11, and causes the vehicle control device 11 to transition from the reprogramming mode to the normal mode, and causes the vehicle control device 11 to reset. Upon reset, the vehicle control device 11 is restarted in the normal mode, and the arithmetic unit 111 executes the start program 1121, and executes the newly written new control program as the current control program.

Fig. 9 is a flowchart showing an example of the current program information acquisition process S801. Next, each step of fig. 9 will be described.

When the calculation unit 111 of the vehicle control device 11 receives the current program information request message M801 from the gateway 12, the processing shown in the present flowchart is started.

The arithmetic unit 111 reads the part number of the current control program and the plurality of current program area information stored in the

management data areas

1123a, 1123b, 1123c (S8011).

Next, the arithmetic unit 111 performs a majority decision of the current program area information, and if half or more of the current program area information matches, decides that the value indicated by the matching current program area information is correct (majority decision processing S8012, details of which will be described later). When half or more of the current program area information matches, the arithmetic unit 111 then performs validity determination of data obtained from the result of the majority decision (validity determination processing S8013, details of which will be described later).

If the result of the validity determination is "valid", an information response message M802 including the part number of the current control program indicated by the current program area information and the current program area information is transmitted to the gateway 12 (response) (S8014). By transmitting the part number of the current control program indicated by the current program area information and the current program area information to the gateway 12, the gateway 12 can acquire a new control program for update from the server using these information, and can verify the acquired new control program.

If the current program area information is not equal to or greater than half of the current program area information or if the result of the validity determination is "invalid", an information response message M802 including the error information is transmitted to the gateway 12 (response) (S8015).

Fig. 10 is a flowchart showing an example of the majority decision processing S8012. Next, each step of fig. 10 will be described.

The arithmetic unit 111 starts the processing shown in the present flowchart by executing the majority decision determination program 1126.

First, it is determined whether or not the current program area information (the "current program area information #1" in fig. 10) of the management data area 1123a matches the current program area information (the "current program area information #2" in fig. 10) of the management data area 1123b (S80121). If the data is consistent, the data is used as the correct current program area information, and the data is returned to "half or more consistent" (S80124). If the current program area information of the management data area 1123b does not match with the current program area information of the management data area 1123c (the "current program area information #3" in fig. 10), it is then determined whether or not the current program area information matches (S80122). If the data is consistent, the data is used as the correct current program area information, and the data is returned to "half or more consistent" (S80124). If the current program area information #1 and the current program area information #3 do not match, it is then determined whether the current program area information #1 and the current program area information #3 match (S80123). If the data is consistent, the data is used as the correct current program area information, and the data is returned to "half or more consistent" (S80124).

When at least two of the "current program area information #1", "current program area information #2", and "current program area information #3" do not match, it is considered that there is no match data and "error (mismatch)" is returned (S80125).

Thus, by using at least half or more of the current program area information as the correct current program area information, even if one of the current program area information is accidentally abnormal (data corruption), the operation using the other current program area information estimated to be correct can be continued.

The present embodiment is described by taking a configuration having 3

management data areas

1123a, 1123b, 1123c as an example, but the number of management data areas is not necessarily 3, and may be 3 or more. The number of management data areas is preferably odd, but may be even. In the case where the number of management data areas is even, for example, the information which is found most in agreement among the plurality of pieces of current program area information can be used as the correct current program area information, and in this configuration, the same operational effects as in the majority decision can be obtained.

Fig. 11 is a flowchart showing an example of the validity determination processing S8013. Next, each step of fig. 11 will be described.

The arithmetic unit 111 starts the processing shown in the present flowchart by executing the validity determination program 1127.

The current program area information employed in the above majority decision process S8012 is acquired (S80131). Next, it is determined whether or not the acquired current program area information is a valid value (a value included in a range of values that can be taken as the current program area information) as information indicating the storage area of the current control program (S80132). In this embodiment, the value represents either the 1 st region 1124 or the 2 nd region 1125. If the value is valid, the valid value is used as the correct current program area information, and is returned to "valid" (S80133).

On the other hand, if the acquired data is not within the valid data range, the "invalid" is returned as a range error (S80134). In this embodiment, the value of the 1 st region 1124 or the 2 nd region 1125 is not shown.

In this way, the current program area information is subjected to the majority decision processing S8012, and the validity of the information itself is checked, whereby processing based on abnormal information can be prevented in advance.

Fig. 12 is a configuration example of the information response message M802 transmitted from the vehicle control device 11 to the gateway 12. The message response message M802 has a command M8021, a part number M8022, and current program area information M8023.

The instruction M8021 stores information indicating that the present message is a response to the current program information request message M801. The part number M8022 stores the part number of the current control program of the vehicle control device 11. The current program area information M8023 stores information indicating an area in which the current control program of the vehicle control device 11 is stored.

The component number M8022 and the current program area information M8023 store the information acquired in the current program information acquisition process S801 described above.

Fig. 13 is a flowchart showing an example of the reprogramming start determination processing S802 executed by the gateway 12. Next, each step of fig. 13 will be described.

When the gateway 12 (specifically, the arithmetic unit 121) receives the information response message M802, the processing shown in the present flowchart is started.

The gateway 12 compares the component number 511 of the current control program included in the update package 5 received from the server 2 and stored in the FlashROM 122 with the component number M8022 included in the information response message M802 received from the vehicle control device 11 (S8021). When the component numbers match, the gateway 12 compares the stored area information 513 of the current control program included in the update package 5 with the current program area information M8023 included in the information response message M802 received from the vehicle control device 11.

When these pieces of information match, the gateway 12 transmits a mode transition request message mmade, which is a command to transition to the reprogramming mode, to the vehicle control apparatus 11 (S8023), and causes the vehicle control apparatus 11 to transition from the normal mode to the reprogramming mode, and starts the update process of the program (S8024).

If the comparison processing in steps S8021 and S8022 is inconsistent, the gateway 12 transmits a message notifying an error to the server (S8025), and suspends (does not start) the program update processing (S8026).

By checking the current program area information of the vehicle control apparatus 11 in the gateway 12 before starting the reprogramming mode in this way, an abnormality can be detected, and erroneous program update can be prevented in advance on the gateway 12 side.

Fig. 14 is a flowchart showing an example of the current program area switching determination process S805 executed by the gateway 12. Next, each step of fig. 14 will be described.

After the new control program finishes writing (writing process S803) to the 2 nd area 1125 where the current control program of the vehicle control device 11 is not stored and further finishes the data validity verification process S804 of verifying the validity of the written data, the gateway 12 executes the process shown in the present flowchart to switch the control program executed in the arithmetic unit 111 of the vehicle control device 11 from the current control program to the written new control program.

The gateway 12 determines whether or not the vehicle is in a stopped state (S8051), and if so, transmits a current program area switching request message M807 to the vehicle control device 11 (S8052). On the other hand, when the vehicle is not in a stopped state, the current program area switching request message is not transmitted. Further, when the vehicle is not in a stopped state, the HMI 14 may prompt the driver to stop the vehicle by using guidance based on a screen display or voice. This can prevent the control program from being switched during running, and can avoid abnormal operation of the vehicle or the like due to switching of the control program during running.

Fig. 15 is a configuration example of the current program area switching request message M807 transmitted from the gateway 12 to the vehicle control apparatus 11. As shown in fig. 15, there is an instruction M8071, and switching target area information M8072.

Instruction M8071 indicates that this message is the current program area switch request message M807. The switching target area information M8072 is information indicating a target area to which a new control program is written, and in the present embodiment, as an example, "the 2 nd area" is stored.

Fig. 16 is a flowchart showing an example of the current program area switching process S806. Next, each step of fig. 16 will be described.

When the calculation unit 111 of the vehicle control device 11 receives the current program area switching request message M807 from the gateway 12, the processing shown in the present flowchart is started.

The operation unit 111 determines whether the switching target is the 1 st area 1124 or the 2 nd area 1125 based on the switching target area information M8072 of the current program area switching request message M807 (S8061). When the switching target area is the "2 nd area", the validity check result of the data in the 2 nd area 1125 is read (S8062), the read validity check result is determined (S8064), and when the result is normal, the "2 nd area" is stored in the current program area information of all the

management data areas

1123a, 1123b, 1123c (S8065). Alternatively, when the switching target area is "1 st area", the validity check result of the data in 1 st area 1124 is read (S8063), the read validity check result is determined (S8066), and when the result is normal, the "1 st area" is stored in the current program area information in all the

management data areas

1123a, 1123b, 1123c (S8067).

When all the management data areas 1123a to 1123c are updated, the operation unit 111 transmits an area switching completion response message M808 to the gateway 12 (S8068). On the other hand, when the validity check result in step S8064 or step S8066 is abnormal, the

management data areas

1123a, 1123b, 1123c are not updated, and an area switching failure response message is transmitted to the gateway 12 (S8069).

When the writing process S803 of the new control program is not normal (when the validity check of the data is abnormal), all of the

management data areas

1123a, 1123b, 1123c are not updated and the control area storing the current control program is indicated as it is. Therefore, at the next start-up, the new control program which is not normally written is not executed but the current control program is executed as before. Thus, the current control program can be executed while avoiding execution of a new control program which is not normally written.

Fig. 17 is a flowchart showing an example of the operation of the start program 1121 (start processing S1700). Next, each step of fig. 17 will be described.

When the arithmetic unit 111 detects that ignition has been started, for example, by an interrupt signal or the like, the processing shown in the present flowchart is started by executing the start program 1121.

The computing unit 111 reads current program area information stored in the plurality of

management data areas

1123a, 1123b, 1123c (S1701).

The arithmetic unit 111 performs a majority decision of the current program area information, and decides that half or more of the data of the current program area information is correct (majority decision processing S1702). Then, the arithmetic unit 111 performs validity determination of the current program area information determined to be the correct information in the majority decision (validity determination processing S1703). Details of the majority decision process S1702 and the validity decision process S1703 are the same as those of the majority decision process S8012 shown in fig. 10 and the validity decision process S8013 shown in fig. 11.

When the result of the validity determination processing S1703 is normal and "1 st area", the arithmetic unit 111 executes the control program stored in the 1 st area (S1704), and when the result of the validity determination processing S1703 is normal and "2 nd area", the arithmetic unit 111 executes the control program stored in the 2 nd area (S1705).

Alternatively, if the results of the majority decision processing S1702 and the validity decision processing S1703 are error, an error is set to be a startup error (S1706).

As described above, the vehicle control device 11 of the present embodiment includes the FlashROM 112 and the computing unit 111, and the FlashROM 112 includes: a 1 st area 1124 and a 2 nd area 1125 storing control programs executable by the arithmetic unit 111; and a plurality of

management data areas

1123a, 1123b, 1123c for storing management data including current program area information indicating one of the 1 st area 1124 and the 2 nd area 1125 as a storage area storing a current control program to be executed by the operation unit 111. Therefore, even if 1 management data is accidentally destroyed, other management data can be used to determine the storage area in which the current control program is stored.

Thus, erroneous execution and update of a plurality of control programs stored in the FlashROM 112 can be effectively suppressed.

< concerning modification >)

The present invention includes various modifications, and is not limited to the above-described embodiments. For example, the above embodiments are described in detail for the purpose of describing the present invention in an easy-to-understand manner, and are not limited to the configuration having all described. In addition, a part of the constitution of one embodiment may be replaced with the constitution of another embodiment, and the constitution of another embodiment may be added to the constitution of one embodiment. Further, some of the components of the embodiments may be added, deleted, or replaced with other components.

The above embodiment has a configuration having the FlashROM 112 as a nonvolatile Memory for storing a control program, but is not limited thereto, and other rewritable nonvolatile Memory devices such as an EEPROM (Electrically Erasable Programmable Read-Only Memory) may be used.

In the above embodiment, the configuration example in which the 1 st region 1124 and the 2 nd region 1125 are provided in 1 FlashROM 112 has been described, but it is also possible to realize, for example, that the 1 st region 1124 is provided in one of the 2 storage devices such as FlashROM and the 2 nd region 1125 is provided in the other. The same configuration as in the above embodiment may be realized by providing 3 or more storage areas for storing a plurality of control programs. In this configuration, at the time of updating the control program, the control program may be written (overwritten) in a cyclic order to each storage area (or storage device), for example.

In the above embodiment, the configuration was described in which only the current program area information indicating the memory area in which the current control program is stored is included in the management data stored in the

management data areas

1123a, 1123b, 1123c, but the present invention is not limited thereto.

For example, the management data may contain other information in addition to the current program area information. Fig. 18 illustrates another configuration of management data. In this example, the management data may include, in addition to the current program area information, a part number of the control program, a hash value or checksum value used for verifying the validity of the stored control program, and the like.

In the above embodiment, the description was given of the configuration in which the management data stored in the

management data areas

1123a, 1123b, 1123c includes the current program area information indicating the storage area in which the current control program is stored, but for example, when the number of storage areas in which the control program is stored is 2 (the 1 st area 1124 and the 2 nd area 1125), the management data may include information indicating the writing target storage area of the new control program at the time of updating the control program. In this configuration, a memory area other than the writing target memory area of the new control program is considered to store the current control program, and can be handled in the same manner as the current program area information.

The above embodiment has a configuration having 3

management data areas

1123a, 1123b, 1123c, but is not limited thereto. For example, the configuration may be such that only 1 management data area is provided. In this configuration, the current program area information of the management data area is judged to indicate the area in which the current control program is stored only when the current program area information is a normal value (that is, a value indicating either the 1 st area 1124 or the 2 nd area 1125), and the execution and update of the control program are performed. If the value is not normal, an alarm such as an error is given. This makes it possible to determine that the current program area information value is rewritten to an abnormal value (a value that does not indicate either of the 1 st area 1124 or the 2 nd area 1125) due to some cause.

In addition, in the update processing of the control program, the latest version of the control program is generally written, but there is a possibility that the control program is updated to a version older than the version of the current control program due to a plurality of factors. In this case, the new control program for update refers to the old version of the control program. That is, the updated version of the control program refers to a control program written in the update order immediately before or before the control program.

The respective components, functions, processing units, processing means, and the like described above may be implemented in hardware by, for example, designing them with an integrated circuit. The above-described respective components, functions, and the like may be implemented in software by a processor interpreting and executing a program for realizing the respective functions. Information such as programs, tables, and files for realizing the respective functions may be stored in a memory, a hard disk, a recording device such as SSD (Solid State Drive), an IC card, an SD card, and a recording medium such as DVD.

Symbol description

1. Vehicle with a vehicle body having a vehicle body support

2. Server device

3. Internet line

4. Radio base station

5. Update package

11. Vehicle control device

12. Gateway (program writing device)

13. Vehicle network

14 HMI

1121. Start-up procedure

1122. Rewriting program

1123a, 1123b, 1123c management data area (management data storage area)

1124. Zone 1 (storage zone)

1125. Zone 2 (storage zone)

1126. Majority decision making program

1127. Validity determination program.

Claims

1. A program updating system, characterized in that,

comprises a vehicle control device, a program writing device and a server,

the vehicle control device is mounted on a vehicle and includes a rewritable nonvolatile memory and an arithmetic unit,

the nonvolatile memory has:

a 1 st memory area and a 2 nd memory area for storing a control program executable by the arithmetic unit; and

a plurality of management data storage areas for storing management data including current program area information indicating which of the 1 st storage area and the 2 nd storage area is the storage area in which the current control program being executed by the arithmetic unit is stored;

the program writing device is mounted on the vehicle and connected to the vehicle control device via an on-vehicle network to control update of a control program of the vehicle control device,

the server issues an update package containing a control program for updating the vehicle control device to the program writing device via wireless communication,

the program writing means transmits an identification number indicating the current control program and the current program area information to the server,

the server issues the update package selected based on the identification number and the current program area information transmitted from the program writing device to the program writing device,

the update package includes:

an identification number representing the current control program;

the current program area information;

an identification number indicating a control program for updating; and

information indicating which of the 1 st memory area and the 2 nd memory area is the memory area storing the update control program.

2. The program update system of claim 1, wherein,

the program writing device executes update processing of the control program of the vehicle control device only when the identification number and the current program area information transmitted to the server match the identification number and the current program area information included in the update package received from the server, respectively.

3. The program update system according to claim 1 or 2, wherein,

when the update control program included in the update package is normally written in the nonvolatile memory of the vehicle control device and the vehicle is determined to be in a stopped state, the program writing device transmits a request to the vehicle control device to switch the current program area information to a value indicating a storage area in which the update control program is written.

4. The program update system according to claim 3, wherein,

when the update control program included in the update package is normally written in the nonvolatile memory of the vehicle control device and it is determined that the vehicle is not in a stopped state, the program writing device executes a process for urging the vehicle to stop.